AT related malicious URL (verify.invitetracking.com/remote-auth/login?state===QP9ElZ5oUeRNkVD1UNVlmU1U1QNdkVDJlQWNkU0UVaSVTVD10RWNUT5V1UapnVzI2b4dkY2J1RNlXV5NmbjhVW3pUaPlWVXJGa10WSzl0QOhXS610dJRVTz0EROFza65UeRRlT6VFVNl2bql0asVEZ1Z1VhNnTtl0cJlmT4lEVNdXSE5kMRRlT5FFROJzZ65UeVRVTp9maJtGbFp1csdFZup0QMlGMyIma1knW1xmMhpmRtNGMWdEZwplbiBXNTVWbs12YsplbJZTSpJGcGdlY2JVbJdDcqlEMohlWpdXeOJTWE1kMBpXT3FkeORzYU1kNJl3YspEWhdHaYpVa3lWSYJlROdFcrFWeGhEVydmMOJTSXZFRSJTW6FESOhnSyMVTKBTV5hWbVpWOr10TkJzSwYESPRkUYFVUWtWU4dXVNpGaUFGWWV0UppVRVdkTwI1dsRkW4F1Mj9GdFJVd5UEVKlDMThmRzQ1VkpnVyF1VaBHer50Mjd0TVJUMaVEZyIVcktWYzETROxkSqRVVah0VClzUaRXMwQGdGRVZ0QzRjRnQsV1Voh0VvZUbJZTSTlFMGdkW4pkbJNXSTJmdO1GTuVzVhJnTXlVeShFTsJFWhJTNXFWavpWS1x2VZRXOHpVa3lWSyE1RPNTTt1kaopmTyUVbZRXSy00dFdFT1UEVNBDMD10aCRVW0lERaRTRX1keFRVTp9maJtGbXRWMKlXZ)

SID: 6011084Rev: 1EnabledDerived7 views
History
Fileantiphishing.rules
CreatedAugust 18, 2026
UpdatedAugust 18, 2026
Classificationsocial-engineering
alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify.invitetracking.com/remote-auth/login?state===QP9ElZ5oUeRNkVD1UNVlmU1U1QNdkVDJlQWNkU0UVaSVTVD10RWNUT5V1UapnVzI2b4dkY2J1RNlXV5NmbjhVW3pUaPlWVXJGa10WSzl0QOhXS610dJRVTz0EROFza65UeRRlT6VFVNl2bql0asVEZ1Z1VhNnTtl0cJlmT4lEVNdXSE5kMRRlT5FFROJzZ65UeVRVTp9maJtGbFp1csdFZup0QMlGMyIma1knW1xmMhpmRtNGMWdEZwplbiBXNTVWbs12YsplbJZTSpJGcGdlY2JVbJdDcqlEMohlWpdXeOJTWE1kMBpXT3FkeORzYU1kNJl3YspEWhdHaYpVa3lWSYJlROdFcrFWeGhEVydmMOJTSXZFRSJTW6FESOhnSyMVTKBTV5hWbVpWOr10TkJzSwYESPRkUYFVUWtWU4dXVNpGaUFGWWV0UppVRVdkTwI1dsRkW4F1Mj9GdFJVd5UEVKlDMThmRzQ1VkpnVyF1VaBHer50Mjd0TVJUMaVEZyIVcktWYzETROxkSqRVVah0VClzUaRXMwQGdGRVZ0QzRjRnQsV1Voh0VvZUbJZTSTlFMGdkW4pkbJNXSTJmdO1GTuVzVhJnTXlVeShFTsJFWhJTNXFWavpWS1x2VZRXOHpVa3lWSyE1RPNTTt1kaopmTyUVbZRXSy00dFdFT1UEVNBDMD10aCRVW0lERaRTRX1keFRVTp9maJtGbXRWMKlXZ)"; flow:established,to_server; http.uri; content:"/remote-auth/login?state===QP9ElZ5oUeRNkVD1UNVlmU1U1QNdkVDJlQWNkU0UVaSVTVD10RWNUT5V1UapnVzI2b4dkY2J1RNlXV5NmbjhVW3pUaPlWVXJGa10WSzl0QOhXS610dJRVTz0EROFza65UeRRlT6VFVNl2bql0asVEZ1Z1VhNnTtl0cJlmT4lEVNdXSE5kMRRlT5FFROJzZ65UeVRVTp9maJtGbFp1csdFZup0QMlGMyIma1knW1xmMhpmRtNGMWdEZwplbiBXNTVWbs12YsplbJZTSpJGcGdlY2JVbJdDcqlEMohlWpdXeOJTWE1kMBpXT3FkeORzYU1kNJl3YspEWhdHaYpVa3lWSYJlROdFcrFWeGhEVydmMOJTSXZFRSJTW6FESOhnSyMVTKBTV5hWbVpWOr10TkJzSwYESPRkUYFVUWtWU4dXVNpGaUFGWWV0UppVRVdkTwI1dsRkW4F1Mj9GdFJVd5UEVKlDMThmRzQ1VkpnVyF1VaBHer50Mjd0TVJUMaVEZyIVcktWYzETROxkSqRVVah0VClzUaRXMwQGdGRVZ0QzRjRnQsV1Voh0VvZUbJZTSTlFMGdkW4pkbJNXSTJmdO1GTuVzVhJnTXlVeShFTsJFWhJTNXFWavpWS1x2VZRXOHpVa3lWSyE1RPNTTt1kaopmTyUVbZRXSy00dFdFT1UEVNBDMD10aCRVW0lERaRTRX1keFRVTp9maJtGbXRWMKlXZ"; startswith; fast_pattern; http.host; content:"verify.invitetracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011084; classtype:social-engineering; sid:6011084; rev:1; metadata:signature_severity Major, created_et 2026_08_18;)

References

urlopenphish.com
urljulioliraup.github.io/AT/signature.html?sid=6011084

Metadata

signature severityMajor
created et2026_08_18

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!